Loading story…
Eight alleged victims of Greece’s “Predatorgate” scandal have sued Athens-based surveillance firm Intellexa SA and 13 associated individuals, seeking €8 million in moral damages over the alleged infection of their phones with Predator spyware in 2020 and 2021. The plaintiffs include people caught up in a scandal that erupted after a financial journalist and a center-left party leader reported surveillance, later expanding through forensic findings that reportedly found Predator traces on dozens of devices and claims that at least 87 prominent Greeks were targeted via malicious SMS links exploiting Chrome and Android zero-days.
The lawsuit adds to mounting legal and political fallout around Predator, Intellexa’s flagship surveillance product. The scandal previously prompted the resignation of the head of Greece’s EYP intelligence service and the prime minister’s chief of staff, while Intellexa-linked entities and individuals were sanctioned by the US Treasury in 2024. Earlier in 2026, a Greek court convicted Intellexa founder Tal Dilian and three others over personal data confidentiality violations tied to 2020–2021 activity, though appeals remain pending; meanwhile, a 2024 Greek Supreme Court prosecutor’s probe reportedly found no evidence that the Greek government or intelligence services were involved.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
A trial in the civil lawsuit brought by eight alleged Greek Predator spyware victims against Intellexa and 13 associated individuals is scheduled to begin in April 2027. The plaintiffs are seeking about €7.6 million in damages over alleged privacy, communications confidentiality, and personal data violations.
An appeal hearing following the convictions of Tal Dilian and three others is scheduled for December.
Eight alleged victims filed lawsuits in Greece against Intellexa SA and 13 associated individuals, seeking €1 million each in moral damages over alleged spyware targeting.
In February, a court convicted Intellexa founder Tal Dilian and three others for violations of personal data confidentiality tied to conduct in 2020 and 2021.
Later forensic findings reportedly identified traces of Predator spyware on dozens of phones, expanding the apparent scope of the surveillance scandal.
The scandal led to the resignation of the head of Greece's EYP intelligence service and the prime minister's chief of staff.
The lawsuit alleges that Predator spyware was used to hack the devices of high-profile Greeks in 2020 and 2021, including through malicious SMS links exploiting Chrome and Android zero-day vulnerabilities.
A 2024 probe by a Greek Supreme Court prosecutor reportedly found no evidence that the Greek government or its intelligence services were involved in the Predator spyware operation.
In 2024, the US Treasury imposed sanctions on Intellexa-linked entities and individuals in connection with the spyware affair.
In 2022, Greece's Predatorgate scandal became public after a financial journalist and a center-left political party leader said they had been subjected to state surveillance using Predator spyware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourceeuronews.al
Open sourcetheregister.com
Open sourceekathimerini.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Greek court in Athens sentenced **Intellexa** founder **Tal Dilian** and three associates—**Sara Hamou**, **Felix Bitzios**, and **Yiannis Lavranos**—to prison for their roles in the “Greek Watergate” spyware scandal involving illegal wiretapping and privacy violations tied to Intellexa’s *Predator* spyware. Local reporting cited by multiple outlets indicates the court imposed sentences totaling more than **126 years**, which under Greek law translate to **eight years** to be served; the court also ordered further investigation, and the defendants are expected to **appeal** and remain free pending the appeal process. The case stems from allegations that *Predator* was used to surveil Greek targets including **politicians, journalists, businesspeople, military officials, and other public figures**, with reporting citing **more than 90** victims in Greece during **2020–2021**. Lavranos’s company **Krikel** was reported to have links to the procurement of *Predator*. The convictions mark a notable legal milestone against a commercial spyware vendor; Intellexa and associated entities have also faced international scrutiny, including **U.S. sanctions** in 2024 over alleged misuse of the spyware, and experts noted the guilty verdict and custodial sentence could increase cross-border legal exposure even if defendants attempt to avoid Greek jurisdiction.
Jun 29, 2026
Investigations by Amnesty International, media partners, and other researchers linked the **Predator** mercenary spyware ecosystem to campaigns targeting politicians, journalists, civil society figures, and officials across multiple countries. One probe found suspected Vietnamese government-linked operators used malicious X posts and fake news links in an attempt to infect the phones of U.S. lawmakers and journalists, including members of Congress and reporters covering national security and Taiwan. Separate reporting tied Predator to earlier abuses in Greece and elsewhere, while technical analysis showed the malware could exploit multiple zero-days, pair with the **Alien** component for persistence, and steal messages, record calls, and activate device microphones. The widening scandal triggered government action and court cases against the spyware network behind Predator. The United States blacklisted Intellexa and Cytrox and later imposed additional sanctions on Intellexa, citing national security risks from the commercial surveillance trade. In Greece, courts convicted executives in the Predator wiretapping case, including an Israeli spyware maker who received an eight-year sentence, while Amnesty continued to document new alleged targeting, including a journalist in Angola and further evidence from the **"Intellexa Leaks"** that the spyware industry remained active despite mounting scrutiny.
Jun 29, 2026
A Greek court sentenced **four Intellexa executives** to **eight years in prison** for their role in the “**Predatorgate**” spyware scandal, which involved use of **Predator** spyware against **90+ public figures**. Prior investigations by **The Citizen Lab** and others documented Predator’s presence in Greece and confirmed infections on devices belonging to journalist **Thanasis Koukakis** and former Meta trust-and-safety manager **Artemis Seaford**, marking a rare case where executives at a mercenary spyware firm faced criminal conviction and prison time. In Italy, prosecutors in Rome and Naples confirmed via a technical report that journalist **Francesco Cancellato** and immigration activists **Giuseppe Caccia** and **Luca Casarini** showed traces consistent with **Paragon Solutions** spyware infections during the early hours of **2024-12-14**, suggesting a coordinated infection campaign. Italian authorities also inspected a Paragon spyware server used by the intelligence agency **AISI** and found evidence of operations against Caccia and Casarini but not against Cancellato, leaving attribution for Cancellato’s compromise unresolved; the case follows **WhatsApp** notifications to roughly **90** people warning they were targeted with Paragon spyware.
Jun 29, 2026